WEb/SEO/App spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on


________________________________

From: Alok Kumar

Sent: 19 June 2026 12:09

Subject: SEO Proposal?





Hi,







I came across your website and wanted to reach out.







If you're interested, I can send information about our SEO services and pri=

cing.







If you'd prefer not to receive emails from me, simply reply with "No thanks=

" and I won't contact you again.







Kind regards,



--_000_TY0PR04MB73504AD188FB2B50CF51B52D82EF2TY0PR04MB7350apcp_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable








>








>
lack;">Hi,




ite; margin: 0cm;">


ack;"> 




ite; margin: 0cm;">


ack;">I just wanted to check if you received my previous email.




ite; margin: 0cm;">


ack;"> 




ite; margin: 0cm;">


ack;">If you're interested, simply reply with "
ont-family: Calibri, sans-serif; font-size: 11pt; color: rgb(12, 136, 42);"=

>SEND
ze: 11pt; color: black;">"

or "
: 11pt; color: rgb(12, 136, 42);">P
: Calibri, sans-serif; font-size: 11pt; color: black;">roposal,"=

; and I'll share the details. If not, just reply

"
1pt; color: rgb(222, 106, 25);">REMOVE
ily: Calibri, sans-serif; font-size: 11pt; color: black;">" or "<=

/span>
or: rgb(222, 106, 25);">NO
, sans-serif; font-size: 11pt; color: black;">."




ite; margin: 0cm;">


ack;">I'm waiting for your response!




ite; margin: 0cm;">


ack;"> 




ite; margin: 0cm;">


ack;">Thanks!








yle=3D"font-size:11pt" color=3D"#000000">From: Alok Kumar


Sent: 19 June 2026 12:09


Subject: SEO Proposal?

 









ckground-color:rgb(255,255,255); margin:0cm 0cm 0.0001pt">


color:rgb(112,48,160)">Hi,




ckground-color:rgb(255,255,255); margin:0cm 0cm 0.0001pt">


color:rgb(112,48,160)"> 




ckground-color:rgb(255,255,255); margin:0cm 0cm 0.0001pt">


color:rgb(112,48,160)">I came across your website and wanted to reach out.<=

/span>




ckground-color:rgb(255,255,255); margin:0cm 0cm 0.0001pt">


color:rgb(112,48,160)"> 




ckground-color:rgb(255,255,255); margin:0cm 0cm 0.0001pt">


color:rgb(112,48,160)">If you're interested, I can send information about o=

ur SEO services and pricing.




ckground-color:rgb(255,255,255); margin:0cm 0cm 0.0001pt">


color:rgb(112,48,160)"> 




ckground-color:rgb(255,255,255); margin:0cm 0cm 0.0001pt">


color:rgb(112,48,160)">If you'd prefer not to receive emails from me, simpl=

y reply with "No thanks" and I won't contact you again.
>


ckground-color:rgb(255,255,255); margin:0cm 0cm 0.0001pt">


color:rgb(112,48,160)"> 




ckground-color:rgb(255,255,255); margin:0cm 0cm 0.0001pt">


color:rgb(112,48,160)">Kind regards,











--_000_TY0PR04MB73504AD188FB2B50CF51B52D82EF2TY0PR04MB7350apcp_--

WEb/SEO/App spam from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 22 Jun 2026 05:35:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbcvC-00000000GXJ-42p1

for dave@doctor.nl2k.ab.ca;

Mon, 22 Jun 2026 05:34:34 -0600

Resent-From: The Doctor

Resent-Date: Mon, 22 Jun 2026 05:34:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japaneastazolkn19013078.outbound.protection.outlook.com ([52.103.43.78]:32149 helo=TYDPR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbbev-00000000NmW-3mbD

for root@nk.ca;

Mon, 22 Jun 2026 04:13:52 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=fxiEwh3QcXtvgB07CeHkgSCEJQ11fC7YqNdGitPscOx/1fkht0NoR6PenhDsjDA3XLt5ZHAbhfnDEyF9z0MioPjLJm3RRan6l2lzxCs/jB1zPS9MmczNY7a84u4Q1IqoLKSL45zRUbPBJXPIb7hJN6bYsYtMSorEIG4GB3R0dqAifVKsPn47wKVsaiFlQVFXoBCTtfTDV0aV+qfqe5NbRPgWtdklpKpXG2/CzEJqxvX4xkcDD6byHhnk/r3aZVhmRcoIlJabDghwptBuwGxhkdqU7SmWQlozBMDzp+JiXaiDPuRhaOJvB1mb5VgB4vJT3DW29Y8q/+EDfsBcuxgpwg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=oYJhIEJ6YwKW2BN3Q+UySXRcijJ6TDEz9nGXn5MzK7w=;

b=qtqdWcPUbDM0MzEo0WORSXxkTlm3GibWr8qlLyb/2LjGjjwKFaOeaTU1VszjMGeqGFDi10EiDdZnH/bKkWM0iwAKX/JuQoSr/yJbY0dI/EeWqGPaMITZG4vW7igme7HGj448J1LeWu2IaxxnS627p/nnCBAiK4FcZVCjFLgk/fKF7URTxX7iUvgzbEOCN+bqKC+8F4FcphkLEVw/YGkk5DEIZUvNo71HtW5/C4MXmDYlb1RbPNPrfpsB0B7ZX8+EKo4TEIArWrpnAfqCcX02k+ZWj6ijxtkhiczR/6C2/XEGl/l451MPC70FILegGu8SrLMD+GKz/KU9YmIu0FKqqQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=oYJhIEJ6YwKW2BN3Q+UySXRcijJ6TDEz9nGXn5MzK7w=;

b=fd385fNQGTOardcx1FHGOCL1QcOdNwTDX9QQv36hkm0qtZJXn2NJQj7yJg+EwGlTbaweZ2MjVGi+/cslne3nHfOLAcCxZXPNBCjHPsrh18lDNOsfM67ui7uayuRufh0CgcNUGj+xiucBt9sP6YXY2AMnBBvmultQQprAVJnNR6IoipM5h+Pyjuw6LxnxSgr4qh77ElXDjiNe3X43LZ3gqH1fqvh3x74v4+8NBKliKLs3Hy8qxY3/bA3maTN+wuobiZcgxFTxaW42IgkfQnuu7GGpYLSbj4rSio+muUvJfwDBhfY+83oh0LjHgmkDgU/pY6kC3r7aUynxnTf9g74iIQ==

Received: from TY0PR04MB7350.apcprd04.prod.outlook.com (2603:1096:405:16::13)

by TYZPR04MB6787.apcprd04.prod.outlook.com (2603:1096:400:340::11) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.139.19; Mon, 22 Jun

2026 10:12:10 +0000

Received: from TY0PR04MB7350.apcprd04.prod.outlook.com

([fe80::7b6:9784:4d31:586f]) by TY0PR04MB7350.apcprd04.prod.outlook.com

([fe80::7b6:9784:4d31:586f%6]) with mapi id 15.21.0139.018; Mon, 22 Jun 2026

10:12:09 +0000

From: Alok Kumar

Subject: Re: SEO Proposal?

Thread-Topic: SEO Proposal?

Thread-Index: AQHc/7ZT/8MWc9Tu7ku57JsQJwBnMLZKXXxW

Date: Mon, 22 Jun 2026 10:12:08 +0000

Message-ID:



References:



In-Reply-To:



Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TY0PR04MB7350:EE_|TYZPR04MB6787:EE_

x-ms-office365-filtering-correlation-id: fbfa3ba6-8d28-4328-6592-08ded046b801

x-microsoft-antispam:

BCL:0;ARA:14566002|51005399006|31061999003|19110799012|8060799015|8062599012|25010399006|55001999006|24021099003|24121999003|12121999013|22091999003|15080799012|15030799006|102099032|3412199025|440099028|40105399003|26121999007;

x-microsoft-antispam-message-info:

=?us-ascii?Q?IcEDK3gAk52bjixBJOb0doYwPLOjJ24Bi631cCDQT1z2CsjOszrfUPuofjOr?=

=?us-ascii?Q?X8FX0DKTzwtXk0J8AGQ2lxjDbrZqsSmoCQGiymn4x5V2xZJhBV0Q3tYMMU9s?=

=?us-ascii?Q?/gxsimDNSo2qzOYKwZfucvC5TFrT6h6AkcOjqUJE38Bay8+q7i55oGvOoFP5?=

=?us-ascii?Q?W/lwJdlkixDtugAC3XLAXilMKPpyoY3aiVbxIhDxq79tddosuWs34IoQfNsX?=

=?us-ascii?Q?2Apji7aaYX4bcQTkM+pzOEiu2Qgx40dTeL8oAsiynKaWig3ZDmNexQJon1LV?=

=?us-ascii?Q?0X5O7VvVbB0X57dajjg0XzuBd1k3i96/RzJpXE+MjyCRkazEx0O1CrEUMjm8?=

=?us-ascii?Q?Ey+k7oXHhCqKSALXjwOj3Nx/fQcfzqHs6j4mxMyWFznG6VmrZa+V52vBh61r?=

=?us-ascii?Q?J2yHoKld5f5lRYUi3XPhZQ+jWPH4zoSx7N3CTd/HWAKsPJWpaG+oJdZVVfhU?=

=?us-ascii?Q?55gre6Lv4/ZhGRBif0BoKPt6tqTj59UVaSYOABp7pAekYik4oSzJsS47NRAB?=

=?us-ascii?Q?H6g69dxX/lBOKmjakGchg8MiBW5/2bowQKOg6jnGWQCs0L1l68jL6K36q/Gp?=

=?us-ascii?Q?RX1BaWYQZouG+4ytKQLOVhuWa7haGeGIVPXf7O2ewh4rPnHoPRL7CQ077VA3?=

=?us-ascii?Q?FOuRJ4r0y0CKL0VEcDQSUaOgNYQTCOgQBbcIhcep0aISFUb4OdgaHRVjWcqQ?=

=?us-ascii?Q?VimXqdA6XsNJjov4cWwL4XXtCl+WF/inVTiVFt+QCM3ZDNIShNyeGwpuub3z?=

=?us-ascii?Q?RhFWPsw9Z4iSF2poa/+ry+4G/FvIu+XE4slnSsLFPI9TipHyT9WPDKUJaBIY?=

=?us-ascii?Q?iY3Da4dSMa6wHxc2ss2qNqdEi6E+kG1E2NS7SXhNrzsZbjKEGMqVj9Cv6UoQ?=

=?us-ascii?Q?fLoDm5UpO24UwuHgXweo1K1CxYHAuD82QeMW6pRL1t7eGtJuUXyNYbKo7Kh5?=

=?us-ascii?Q?FKMxIlUI3MkJxgOsw7EGkUokGI3SThDB4KzdX0NpVRP/SjgPYxcww3qIu937?=

=?us-ascii?Q?7A+eHHcJ5oswJSOO4ZfjtQ/QH/WYlMKjCzagmHbMLe3gw/zrb0YQ7KSV4VYo?=

=?us-ascii?Q?otkSK4VthfZaoGQ8wOrLsbdgiuUmujc9Mfd/zkESvQqgZc2bsiaH3Uj2oYBJ?=

=?us-ascii?Q?cgnPn/2JCWOY?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?us-ascii?Q?CExs97+055ZdwftY8omQRU9Fsiig6VpYceYWfwHra9HbgXwdWPbB0l86CIyA?=

=?us-ascii?Q?OXPH3cBSioNO6feat8kvyhVUurVs1QJ+aYszO9CzDMat+h/8fRuxR2fz2oYs?=

=?us-ascii?Q?POnNS0dzMk/XnLYu3xA7ajvJ75bR9B4GquEHFc0Eo5U6/5KRqlN/OHw4AxHp?=

=?us-ascii?Q?zuDE/b4qQRgrxr6tWOSN/OP/nLQwd3UagtSvB8AB81KALsSdnpRJEbZDeHM/?=

=?us-ascii?Q?6nDXUI72JqGAqvfDBT2YLhF1trUI3nRGy1ImkimIymOphs3Q5kLaaRhmIQwM?=

=?us-ascii?Q?7RHriD4JYQR00FLK/+/gkN/HVLZFGxxbtVObZS0QJjxtgH+tvSLAF4rZq/No?=

=?us-ascii?Q?IK4N+vJex0+CkzzMN1Kr58YqTikYM/vLTmJnBiOYmxj1rj7I/jrZY5Ths0o9?=

=?us-ascii?Q?MHPoJmuBe37DplMrtmHnSMd/TWYE3q71AJoBMqvhPvEFfUYVDsJ1EDh10jbR?=

=?us-ascii?Q?EKHNJswS82KdrAIcsHxSVzOrFGZmJPbo2FHsUDCz9Jg0VpB9BW1GOGFC/xDR?=

=?us-ascii?Q?HMde4B9Lcsd8+28+DcZc1if8VOi99mtPXPa/fJOrprHaF6dl9snZHZ0PIbWo?=

=?us-ascii?Q?/uyDI3CBRex25wcgcRtXTThRawPq8BbAkBnmofR5Yr5sN6+MwbCuW4HQIpYw?=

=?us-ascii?Q?B9FCigKqOQMyDIeOsDZqslFwTkk7bbcTYNwZnz5h10yq/gUEjYolGm3ZMiNX?=

=?us-ascii?Q?pxqlKP8Aqp6ZetoEy9Z0Z3EskOCzLBXTgvF63v/NSDPeimenj4f5UUOxNe1b?=

=?us-ascii?Q?q3wCgQzRpTkkf0RwaugW6+ebE7Sl25fxyypiTRSNuXSAwHUE9et+UitOdaRS?=

=?us-ascii?Q?U992fK3ECm5ZxB4HHdoxbnbdjZNrCd7qdWddZLVqpqgytBIk6wQphbIEClwn?=

=?us-ascii?Q?84pJu8Me1BwR6tF3FThcJ+edyTEseHp/4CAw95UCIaF/U73sTQVIAeqbZA3z?=

=?us-ascii?Q?+TaRc/uxKmdRwcmWmQuUd1b0KbwF0dRoLdOgKNJLhxHjgKH2DUgETUjGpeCE?=

=?us-ascii?Q?cL+poSnn5tB05hJ39Kr9jnzTZx22ITETPAJWi13xoDNcumQCATzMu1b0/f6m?=

=?us-ascii?Q?efSaNKduuBioqIzvv3YyXZBjyw8F851+nx/8vxm1709v81iaGDlC5guTlNae?=

=?us-ascii?Q?KoplgsZY87LlhaiG4zjv4WSS0IJszXBl0ymohjvNVpMKdJxplQIH/ajweZXZ?=

=?us-ascii?Q?+YZwqxeXhi5BKz0/h2EWrGmkVYNrTTjy/qHOmHU4nXADge+rsMN3v1oqGQ0u?=

=?us-ascii?Q?36Qa6F56S8gksWHxh/Jgd9IhxOHasoDk6AX3iWUTMJX0ZJZUJh9Trmrm2Hcq?=

=?us-ascii?Q?6vT2U4CriMEKnvHa+G500o5Ey84614LuZebRp8wrIf2CJxGtaTneItWrs9Tp?=

=?us-ascii?Q?cq8fyFmBuN5iEWc2CivpjPr7K5WxDiYvR3TX/hctuVgxf3dRVAyiRsxzKCjS?=

=?us-ascii?Q?v4BUGZT695sA40HxlWtpPRaABKzpG/CI?=

Content-Type: multipart/alternative;

boundary="_000_TY0PR04MB73504AD188FB2B50CF51B52D82EF2TY0PR04MB7350apcp_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-c3e7a.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TY0PR04MB7350.apcprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: fbfa3ba6-8d28-4328-6592-08ded046b801

X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jun 2026 10:12:08.6445

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYZPR04MB6787



--_000_TY0PR04MB73504AD188FB2B50CF51B52D82EF2TY0PR04MB7350apcp_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



Hi,







I just wanted to check if you received my previous email.







If you're interested, simply reply with "SEND" or "Proposal," and I'll shar=

e the details. If not, just reply "REMOVE" or "NO."



I'm waiting for your response!







Thanks!

Web/SEo/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 22 Jun 2026 05:35:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbcuy-00000000GWx-0y0M

for dave@doctor.nl2k.ab.ca;

Mon, 22 Jun 2026 05:34:20 -0600

Resent-From: The Doctor

Resent-Date: Mon, 22 Jun 2026 05:34:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f71.google.com ([209.85.217.71]:47109)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbZNA-000000006Ne-43Eq

for root@nk.ca;

Mon, 22 Jun 2026 01:47:22 -0600

Received: by mail-vs1-f71.google.com with SMTP id ada2fe7eead31-71f4e6ff16eso5402502137.2

for ; Mon, 22 Jun 2026 00:46:24 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1782114378; x=1782719178; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=MkVm3oBXmPpWontr+vki8bR1eTBijQaBlcjJF7RymwQ=;

b=QnpqlwzgYl0/g5YEA1ZZ8Ak4lvUKS9P0MeOrI/FZmlO4eb6ndyup1KX0ZrtbPn11vi

2TIyuGcbYUlVHqjoekDUZvTa/OcSuFMKU+T3ZNqBEQjFjUFDTZeppLxkGC6Mw9mKQrUd

xJAcB53RcYhSQG/F2xTGgPvZQWSe5JXgfUztNbDmfFGicTNQVq9RMPE6dscidPQKgkSq

CFpxDeJ04M9b/n/twY/Bm/ipt0XrQzqP1U0R1NpWrxwNu5vsdU56zj16dC1DRtqYGJ2K

bLhF0bFIexkKzvW2NJ2N5CiVD5DoCHmlj+AwxecaqB8ccK2gKFy9JkWW7i23QVOpzVUp

AipQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782114378; x=1782719178;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=MkVm3oBXmPpWontr+vki8bR1eTBijQaBlcjJF7RymwQ=;

b=nB/wzlQT2mfJ3o9Bv5ceRwv8B+enPEvU+2MvaTDnk1j9bZGwSGg/0mr9n9UkIMm+Dj

ssK1CoGT6441RChxmHllprWlPQqwg3v9MptlEYVfkCIeyqIJINQPE+pcyVm07rOqZHOH

Vsaox3kl0cJXV/FIef6yUBWfJDN6bBi1BvJO4AS656WdqTgbLFw/dGZwjLe1PORQ6hAK

I5UOtb0PVEhYlgJKAJBfxD2CVVVgZw7ip2RB/HCXeFWRSGk/L0+RPCR0msKbmKw2wISj

HhpuwgGADUJXLWV+bju/oSG3IoIBUSj5kHsC8Ug6QrU7YiYedcRD31+FoOhFDZf2rzZw

qGBQ==

X-Gm-Message-State: AOJu0YygvOHyA74XknewEnrLjs8vbGQrZR13gfz93ECrFpChGWZO+Zv5

TUh50vFIr9pdo54Y5Yb2JQSKnY88CCWiMvqmHRfOGcR7b8hib/Wr7jzNUopI6UIeIzjcPEIGgC7

gA3PRBg==

MIME-Version: 1.0

X-Received: by 2002:a05:6102:160e:b0:631:3bbb:f23f with SMTP id

ada2fe7eead31-72a795e1c40mr6424207137.26.1782114378056; Mon, 22 Jun 2026

00:46:18 -0700 (PDT)

Message-ID:

Date: Mon, 22 Jun 2026 07:46:18 +0000

Subject: Re: Quick Service ! root@nk.ca ! My Name is Puja

From: pujar2476@gmail.com

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000740e690654d2d66e"



--000000000000740e690654d2d66e

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Hi,



Check on my last message.



Please share your project requirements or a reference app so we can provide

an estimate for timeline and cost.



Thanks,

Puja



On Tue, Jun 9, 2026 at 11:10 PM < root@nk.ca > wrote:



Hello, root@nk.ca



We can develop your mobile app for iOS & Android using Flutter with a

single code base for fast, smooth, and cost-effective performance.



Scope:-



User-friendly UI/UX

Login / Signup

API & backend integration

Push notifications (if needed)



Tech:-



Flutter / Custom Backend



Timeline & cost will be shared after reviewing full requirements.



Please share your details or reference app so we can proceed.



Best regards,



Puja



--000000000000740e690654d2d66e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi,

Check on my last message.

Please share your project requi=

rements or a reference app so we can provide an estimate for timeline and c=

ost.

Thanks,
Puja

On Tue, Jun 9, 2026 at 11:10=E2=80=AFPM =

< root@nk.ca > wrote:

Hello, root@nk.ca

We can develop your m=

obile app for iOS & Android using Flutter with a single code base for fast,=

smooth, and cost-effective performance.

Scope:-

User-friendl=

y UI/UX
Login / Signup
API & backend integration
Push notification=

s (if needed)

Tech:-

Flutter / Custom Backend

Timeline=

& cost will be shared after reviewing full requirements.

Please sha=

re your details or reference app so we can proceed.

Best regards,
>
Puja

--000000000000740e690654d2d66e--

Chinese products spam part 2

Posted by Dave Yadallee on
在2026-06-19，Julin 写道:



-----原始邮件-----

发件人： Julin

发件时间: 2026年06月19日 周五

收件人： [sales ]

主题： 中国发加拿大整柜价格 5.15-5.31



Hi 家人们

我是深圳市云松跨境物流有限公司的Julin，



我们专注于美加欧澳墨西哥国际物流13年，能做CIF,FOB ,DDU,DDP,LDP等条款.







请问本周有整柜发加拿大吗？



我们有很好的整柜价格，可以为您节省成本，



目前我们帮单一客户节省了30万美元的成本。



我们擅长DDU,DDP,LDP等贸易条款，可以合理的帮您优化物流成本，减少支出。



欢迎扫码加微信，随时详聊!



祝您万事如意，生意兴隆，货如轮转，财源滚滚。



整柜价格

起运港 目的港 价格（40HQ） 备注

深圳/广州/宁波/上海/义乌/青岛/天津/长沙/郑州/佛山/中山/泉州 温哥华 2830 这个是海运价格

埃德蒙顿 4000

卡尔加里 4000

多伦多 5015

蒙特利尔 5015

温尼泊 5500















Obtain the latest product info by choosing . Keep My News Flow



Need to pause messages? Go to Opt Out Settings.





Miss Julin



深耕美加专线13年



DDU/DDP双清专线,让您省心省力省钱



Shenzhen Yunsong Cross-border Logistics Co.,Ltd



Room 2806, 28th Floor, Building 1, Evergrande Metropolis Plaza, Bantian Street, Longgang District,



Shenzhen City, Guangdong, China



深圳市龙岗区坂田街道马安堂社区环城南路15号



恒大都会广场1栋2806



Phone : 13798412845



Email: julin@yunsongfreight.com











在2026-06-13，Julin 写道:



-----原始邮件-----

发件人： Julin

发件时间: 2026年06月13日 周六

收件人： [sales ]

主题： 加拿大FOB/DDP/LDP ，一箱也能发



Hi 亲们



我是深圳市云松跨境物流有限公司的Julin，



我们专注于美加欧澳墨西哥国际物流13年，能做CIF,FOB ,DDU,DDP,LDP等条款.

下面是不同的重量发加拿大的价格，一箱也能发，几百元就到加拿大，双清包税到门。

欢迎扫码加微信，随时详聊!DDU/DDP双清专线让您省心省力省钱。

祝您万事如意，生意兴隆，货如轮转，财源滚滚。





散货价格

起运港 目的港 价格（40HQ） 备注

深圳/广州/宁波/上海/义乌/青岛/天津/长沙/郑州/佛山/中山/泉州 温哥华 8.3 散货包含海运费，清关，关税，派送

埃德蒙顿 7.5

卡尔加里 7.5

多伦多 8.1

蒙特利尔 8.1

温尼泊 8.2







Maintain your product-savvy edge with . Stay Updated on News



If you prefer to exit, choose Review Communication Options.





Miss Julin



深耕美加专线13年



DDU/DDP双清专线,让您省心省力省钱



Shenzhen Yunsong Cross-border Logistics Co.,Ltd



Room 2806, 28th Floor, Building 1, Evergrande Metropolis Plaza, Bantian Street, Longgang District,



Shenzhen City, Guangdong, China



深圳市龙岗区坂田街道马安堂社区环城南路15号



恒大都会广场1栋2806



Phone : 13798412845



Email: julin@yunsongfreight.com











Chinese products spam part 1

Posted by Dave Yadallee on


X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 22 Jun 2026 05:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbcue-00000000Fo5-1lP5

for dave@doctor.nl2k.ab.ca;

Mon, 22 Jun 2026 05:34:00 -0600

Resent-From: The Doctor

Resent-Date: Mon, 22 Jun 2026 05:34:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [210.79.60.58] (port=57558 helo=mail-m6058.netease.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbZEK-0000000062y-1nOo

for sales@nk.ca;

Mon, 22 Jun 2026 01:38:23 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_1519968_391243307.1782113820732"

To: sales

Subject: =?UTF-8?B?UmU65Lit5Zu95Y+R5Yqg5ou/5aSn5pW05p+c5Lu35qC8wqA1LjE1LTUuMzE=?=

X-Priority: 3

MIME-Version: 1.0

Received: from julin@yunsongtrans.com( [10.139.1.59] ) by ajax-webmail ( [127.0.0.1] ) ; Mon, 22 Jun 2026 15:37:00 +0800 (GMT+08:00)

From: Julin

Date: Mon, 22 Jun 2026 15:37:00 +0800 (GMT+08:00)

X-WM-Tid: 0a9eee42dfa800f5kunm075a0cc51e7cc6

DKIM-Signature: a=rsa-sha256;

b=asezRNYEJYWChLe/c8MKhCFg8Nm+6NkMV+xq+u4I9n517u2GK6cC/SJcFLQQrlDSdw8amcSnRMNrS05n/N0k3FzVz5yNvzpSFOrznEBjG5GbkUvZdR0uJVHURcn8wakKeC+lnCw6VJ38FV8+moKZY+2zeXMeLIm3elxQ3fimTAnhhC+2Cv1ixMq8H4yQoJaII7XX+cJMws8Uo9ubBus3ugKzRV3Ht5Y6SE7lrj4tW238mbQM08IcmoO1YxZruRIzomgrRsbcVcVw40ehE2LFzcwxQy/mnApfDAbVclSITMQE0ga+3MDv+B94bHL82eS0SSgU43JB/5bblac01NqSOQ==; c=relaxed/relaxed; s=default; d=yunsongtrans.com; v=1;

bh=D9O4+3Fuf8oZkx9Z8Eq1iHpXhHKH4I1XzWG41NnHxr0=;

h=date:mime-version:subject:message-id:from;

Message-ID:

X-Spam_score: 15.3

X-Spam_score_int: 153

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi sales, I hope this email finds you well. Thank you for

reading our introductory email. We're here to assist if you have any further

questions or need more information. I am excited to inform you that we are

currently offering a special promotion on our products.If you have any needs,

please let me know as soon as possible so I can secure a discounted spot

for you. T [...]



Content analysis details: (15.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[210.79.60.58 listed in will-spam-for-food.eu.org]

[210.79.60.58 listed in will-spam-for-food.eu.org]

[210.79.60.58 listed in will-spam-for-food.eu.org]

[210.79.60.58 listed in will-spam-for-food.eu.org]

[210.79.60.58 listed in will-spam-for-food.eu.org]

[210.79.60.58 listed in will-spam-for-food.eu.org]

[210.79.60.58 listed in will-spam-for-food.eu.org]

[210.79.60.58 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[210.79.60.58 listed in dnsbl.ahbl.org]

[210.79.60.58 listed in dnsbl.ahbl.org]

[210.79.60.58 listed in dnsbl.ahbl.org]

[210.79.60.58 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[210.79.60.58 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[210.79.60.58 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[210.79.60.58 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[210.79.60.58 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: yunsongtrans.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[210.79.60.58 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.6 J_CHICKENPOX_52 BODY: 5alpha-pock-2alpha

1.0 OPT_OUT BODY: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.6 HTML_TEXT_INVISIBLE_STYLE HTML hidden text + other spam signs

2.0 MIXED_HREF_CASE Has href in mixed case

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?B?UmU65Lit5Zu95Y+R5Yqg5ou/5aSn5pW05p+c5Lu35qC8wqA1LjE1LTUuMzE=?=



Hi sales,

I hope this email finds you well.

Thank you for reading our introductory email. We're here to assist if you have any further questions or need more information.

I am excited to inform you that we are currently offering a special promotion on our products.If you have any needs, please let me know as soon as possible so I can secure a discounted spot for you.

Thank you for your attention, and I look forward to hearing from you soon.

Best regards,







Enable premium notifications for product growth via . Keep My Alerts Active



To override these emails, visit Tweak Email Delivery.





Miss Julin

With 13 years of dedicated focus on US-Canada dedicated shipping lines,we save your time, effort and money with DDP PRICE.

Shenzhen Ethan Freight Forwarding Co., Ltd.

Room 2806, 28th Floor, Building 1, Evergrande Metropolis Plaza, Bantian Street, Longgang District, Shenzhen City, Guangdong, China

T.0755-84826401/ M.13798412845/E.julin@ethanfreight.com

www.ethantrans.com

Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 21 Jun 2026 20:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbUHC-0000000013Z-2WTW

for dave@doctor.nl2k.ab.ca;

Sun, 21 Jun 2026 20:20:42 -0600

Resent-From: The Doctor

Resent-Date: Sun, 21 Jun 2026 20:20:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp1.hukvm.de ([193.201.183.163]:9127)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbSwk-00000000DIS-04QD

for root@doctor.nl2k.ab.ca;

Sun, 21 Jun 2026 18:55:38 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;

d=hukvm.de; i=@hukvm.de; q=dns/txt; s=mail2;

t=1782089730; x=1813625730;

h=from:to:subject:date:message-id:mime-version;

bh=ouWN5M9Ewbinr3DwVfFv0e4qikVrKtwEOsY20ywIb2I=;

b=CAJOOg80PlKMPWE/5Wr06v/mm8uQ37pomjsHeQoQfP/tA90yNPLtKEOF

9bX7U05baFg+Tv7A7vKWQ8/I1ooHWlHhLTgOb/igB5x4TrbtnWpV8yRGw

AvcOIJLmwV6GEyL93gPDezzxRCsGtovYQiqaRk+iQi7+Ky60IflP+tXgk

o=;

X-CSE-ConnectionGUID: bjnAT2BuSXWmGw8uYLWlRw==

X-CSE-MsgGUID: +wO+zXS6Q+a1XHYaPkUOoQ==

From: "HUK Vertrauensmann Stecker, Michael"

To: "lpjobswelll@gmail.com"

Subject: Congratulations!!!

Thread-Topic: Congratulations!!!

Thread-Index: Ad0B4aovvTDlMAqKQk+1sQ1o67xE0w==

Date: Mon, 22 Jun 2026 00:54:32 +0000

Message-ID:

Accept-Language: de-DE, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-originating-ip: [10.148.148.66]

Content-Type: multipart/alternative;

boundary="_000_da0c97fd456040dcaa41b2c70ae0f345hukvmde_"

MIME-Version: 1.0



--_000_da0c97fd456040dcaa41b2c70ae0f345hukvmde_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



You have been selected to receive a Grant Donation; please contact lpjobswe=

lll@gmail.com for further details and claim i=

nformation.



Please Note: We have been trying to contact you several times.



Best regards



--_000_da0c97fd456040dcaa41b2c70ae0f345hukvmde_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable








>


>



Congratulations!!!





You have been selected to receive a Grant Donatio=

n; please contact

lpjo=

bswelll@gmail.com for further details and=

claim information.



Please Note: We have been trying to contact you s=

everal times.



Best regards









--_000_da0c97fd456040dcaa41b2c70ae0f345hukvmde_--

Amazon Prime phish from OVH Part 2

Posted by Dave Yadallee on












Prime - Membership Update













prime









Your membership has been paused



Hello,





We were unable to charge your payment method. We've paused your Prime membership and your benefits are currently on hold.





To resume your membership, update your payment method and plan settings.





Thank you,


Customer Service






Update payment method









You expected your Prime membership to continue?





We can help you re-activate your Prime membership. Reach out to Customer Service for help.






Contact Customer Service









©2026 Prime, Inc. or its affiliates. Prime and all related marks are trademarks of Prime, Inc. or its affiliates. Mailing address: Prime ULC, 410 Terry Avenue N., Seattle, WA 98109-5210, c/o Prime Services LLC. If you have any questions and wish to contact us, click here.











Amazon Prime phish from OVH Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 21 Jun 2026 17:24:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbRVU-000000005Yf-3D9A

for dave@doctor.nl2k.ab.ca;

Sun, 21 Jun 2026 17:23:16 -0600

Resent-From: The Doctor

Resent-Date: Sun, 21 Jun 2026 17:23:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.chroniclesnews.live ([66.116.206.87]:57488)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbNQn-0000000017l-0DH8

for www@nl2k.ab.ca;

Sun, 21 Jun 2026 13:02:19 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=chroniclesnews.live; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:List-Unsubscribe:From:To:Reply-To:Message-Id:Subject:Date:Sender

:Cc:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:

Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:

List-Help:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=gVnCm19bSIvDIeo/dz6BzYKtFfjqJAd38lB80TgpQfA=; b=ZbCmG0Qo6rWaxPrHR9pON/U6XJ

Jx5N4nuKGr9krxkrbVU+HALedCZhcoqmBCs25DNDlDrT0aSPUm5l/8bFaL4ixPE0bT/9AsInvQoKX

MQnfBMKHzbSMmXztJSwaIgXFLzw4QSyDp8PuFVJQLTLa2grcw31G2+wofuHEP+mjRtL0cyu7ufGJR

dtKsZ9Z9viJajO6Zlg+nXGlIEJ3E4HD120+HrxsFOpTIIXWcc1mWRXNvHDuNFn/tnfceyN/G+5iGq

27hLinvz+9IEwYE2dmf/PJMtDz9vVlm5FYrLd3JTDheGhg8CFekUhFlFjuPrvlxNM1NgAFlVsdUc4

DYzobnqw==;

Received: from ip18.ip-192-99-159.net ([192.99.159.18]:60924 helo=vps12783)

by server.chroniclesnews.live with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.2)

(envelope-from )

id 1wbNPp-0000000AnmK-3cqa

for www@nl2k.ab.ca;

Sun, 21 Jun 2026 13:01:10 -0600

Date: Sun, 21 Jun 2026 12:01:06 -0700

Subject: Your Prime membership has been paused [Ref: 3976C]

Message-Id: <13CCQKO7LTU4.7KN23T2LL4RW@vps12783>

Reply-To: Prime <>

To: www@nl2k.ab.ca

From: Prime

X-Mailer: Thunderbird 78.11.0

List-Unsubscribe:

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server.chroniclesnews.live

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - chroniclesnews.live

X-Get-Message-Sender-Via: server.chroniclesnews.live: authenticated_id: client@chroniclesnews.live

X-Authenticated-Sender: server.chroniclesnews.live: client@chroniclesnews.live

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 5.4

X-Spam_score_int: 54

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Prime - Membership Update prime



Content analysis details: (5.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.99.159.18 listed in dnsbl.ahbl.org]

[192.99.159.18 listed in dnsbl.ahbl.org]

[192.99.159.18 listed in dnsbl.ahbl.org]

[192.99.159.18 listed in dnsbl.ahbl.org]

[66.116.206.87 listed in dnsbl.ahbl.org]

[66.116.206.87 listed in dnsbl.ahbl.org]

[66.116.206.87 listed in dnsbl.ahbl.org]

[66.116.206.87 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.99.159.18 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.99.159.18 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.99.159.18 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.99.159.18 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[66.116.206.87 listed in bb.barracudacentral.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[66.116.206.87 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Your Prime membership has been paused [Ref: 3976C]

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 21 Jun 2026 12:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbMm9-00000000LUt-18mS

for dave@doctor.nl2k.ab.ca;

Sun, 21 Jun 2026 12:20:09 -0600

Resent-From: The Doctor

Resent-Date: Sun, 21 Jun 2026 12:20:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m81214.netease.com ([47.88.81.214]:46800)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbKuy-000000009bQ-0Av3

for sales@nk.ca;

Sun, 21 Jun 2026 10:21:20 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_1438358_1062877719.1782058805223"

To: sales

Reply-To: serenatam@lebaijk.com

Subject: =?UTF-8?B?Q3VzdG9tIFNob2UgU29sZSBTb2x1dGlvbnMgZm9yIEZvb3R3ZWFyIEJyYW5kcw==?=

X-Priority: 3

MIME-Version: 1.0

Received: from daisy@vexacentertrade.com( [10.139.4.149] ) by ajax-webmail ( [127.0.0.1] ) ; Mon, 22 Jun 2026 00:20:05 +0800 (GMT+08:00)

From: SerenaTam

Date: Mon, 22 Jun 2026 00:20:05 +0800 (GMT+08:00)

X-WM-Tid: 0a9eeafb67d9d0bdkusy9ad71f541ce192

DKIM-Signature: a=rsa-sha256;

b=kV8GSlJnhAlshxH4drkiBSlPKqSbSHP+nQ7LH7lqTNAcdfE1AYBfNSoEW7mN02l/exIQK+0dJWs6KWY0hH03fCbd0sIiDbls9wW3JfyDV0/B2lrgrWngobxOjWBrKEF2j4GpQ2SX086iE62wxKGnO8lMKZOCRzbda1ezLMV59EI=; c=relaxed/relaxed; s=default; d=vexacentertrade.com; v=1;

bh=lWRG7NRaDgjQiH8ebQekJZ7olMsdhmkkRW0lJnKgBZE=;

h=date:mime-version:subject:message-id:from;

Message-ID:





Hi Sales，



We specialize in custom shoe soles, including natural rubber and bio-based sole solutions for footwear brands and manufacturers.



Would you be interested in seeing some of our latest sole designs?



Reply interested if you do.





Best regards,



Maintain your product-savvy edge with . Stay Updated on News



If you prefer to exit, choose Review Communication Options.





SerenaTam

serenatam@lebaijk.com

OVH Amazon Phish from Cox Part 2

Posted by Dave Yadallee on














Prime - Membership Update













prime









Your membership has been paused



Hello,





We were unable to charge your payment method. We've paused your Prime membership and your benefits are currently on hold.





To resume your membership, update your payment method and plan settings.





Thank you,


Customer Service






Update payment method









You expected your Prime membership to continue?





We can help you re-activate your Prime membership. Reach out to Customer Service for help.






Contact Customer Service









©2026 Prime, Inc. or its affiliates. Prime and all related marks are trademarks of Prime, Inc. or its affiliates. Mailing address: Prime ULC, 410 Terry Avenue N., Seattle, WA 98109-5210, c/o Prime Services LLC. If you have any questions and wish to contact us, click here.











OVH Amazon Phish from Cox Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 21 Jun 2026 08:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbJMf-00000000MEk-48k4

for dave@doctor.nl2k.ab.ca;

Sun, 21 Jun 2026 08:41:37 -0600

Resent-From: The Doctor

Resent-Date: Sun, 21 Jun 2026 08:41:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wsip-72-198-249-30.tu.ok.cox.net ([72.198.249.30]:53016)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbITj-00000000HJY-2I1Q

for www@nl2k.ab.ca;

Sun, 21 Jun 2026 07:45:01 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=covenantfamilychurchtulsa.com; s=default; h=Content-Transfer-Encoding:

Content-Type:MIME-Version:List-Unsubscribe:From:To:Reply-To:Message-Id:

Subject:Date:Sender:Cc:Content-ID:Content-Description:Resent-Date:Resent-From

:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:

List-Id:List-Help:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=gVnCm19bSIvDIeo/dz6BzYKtFfjqJAd38lB80TgpQfA=; b=ptwGDsjG5OFmdvuFiaYmmCRk3t

JoC3riCBwDZhY+HxY7WZHTSRKMN6Q0DP1Vr+frYj1bCmp3IRcyGTa5W6ESaOsIDtPYO1CB5pV+ojI

mgUuXeunSkeGNORta30MhI97+ocUrJm8OMJhClmmi7Obf19zYlLK7HU4IBO0fF8URhpVkEqWJRF8d

QJyJI1wTWZdECl9ykv5OFPX0WzPXe5vjmDyZW8/MycbqNq9tyyATHjNBbC7/ts3Qwqf6U4hwuqtCc

TKfIbjEWXeU/XwYi0QtcWKjCbHcSQq2GBjRtQdqgwDPTGlGqBMhd6oes8gT9L5tQfgsGI5401yrCp

hKXBbGVg==;

Received: from ip18.ip-192-99-159.net ([192.99.159.18]:60920 helo=vps12783)

by hop.hopenetsolutions.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.4)

(envelope-from )

id 1wbISr-0000000CX7D-0LJ5

for www@nl2k.ab.ca;

Sun, 21 Jun 2026 08:43:57 -0500

Date: Sun, 21 Jun 2026 06:43:55 -0700

Subject: Your Prime membership has been paused [Ref: 253AA]

Message-Id: <6YDUD595LTU4.4M3FMUBFPICF2@vps12783>

Reply-To: Prime <>

To: www@nl2k.ab.ca

From: Prime

X-Mailer: Microsoft Office Outlook 15.0

List-Unsubscribe:

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - hop.hopenetsolutions.com

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - covenantfamilychurchtulsa.com

X-Get-Message-Sender-Via: hop.hopenetsolutions.com: authenticated_id: hosting@covenantfamilychurchtulsa.com

X-Authenticated-Sender: hop.hopenetsolutions.com: hosting@covenantfamilychurchtulsa.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 9.0

X-Spam_score_int: 90

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Prime - Membership Update prime



Content analysis details: (9.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[72.198.249.30 listed in dnsbl.ahbl.org]

[72.198.249.30 listed in dnsbl.ahbl.org]

[72.198.249.30 listed in dnsbl.ahbl.org]

[72.198.249.30 listed in dnsbl.ahbl.org]

[192.99.159.18 listed in dnsbl.ahbl.org]

[192.99.159.18 listed in dnsbl.ahbl.org]

[192.99.159.18 listed in dnsbl.ahbl.org]

[192.99.159.18 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[72.198.249.30 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[72.198.249.30 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[72.198.249.30 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[72.198.249.30 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[72.198.249.30 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[72.198.249.30 listed in bl.score.senderscore.com]

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

3.2 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr

1)

Subject: {SPAM?} Your Prime membership has been paused [Ref: 253AA]

Document phish from sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 21 Jun 2026 05:32:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbGOh-00000000LNK-2tI1

for dave@doctor.nl2k.ab.ca;

Sun, 21 Jun 2026 05:31:31 -0600

Resent-From: The Doctor

Resent-Date: Sun, 21 Jun 2026 05:31:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wrqvcftr.outbound-mail.sendgrid.net ([149.72.207.117]:36028)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbE5M-000000006ii-2qAr

for sales@nk.ca;

Sun, 21 Jun 2026 03:03:33 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=p3-i.com;

h=content-type:mime-version:from:subject:date:to:cc:content-type:date:

from:subject:to;

s=s1; t=1782032551;

bh=RRkDnOi0P2tMynw2T1RybKdX/x0KHqMvT3WgsDj6c0E=;

b=SZhOxbwJyFOPxxJzRQEaiezKmDpKj4oPuMeLQuaCjtTmir8WDhD2c/TYDzq7n13uNfKz

OmR1bMeIkvgufOEbVl3QqWlrhqLKyYFRn/osKcLUosrEi6eYGeM0wVNUXlBuQBeJ8bszQi

Y2CYCdg+6aQYtxd1MqZr/jDAMuL63YtLp6PBuINHUz33pUORB8C+G+pWD0ES7wghiHs5xn

OmxJq/FqxMG+x1x5w/O9pjW+aeATcjgCVYMp4KTc+7p3I7U5w9TTrtq5RNuQODXqBLNLKH

FIYbR8Ne7FAqPJg0ptkf8onXZXgDAmAU4gLg5NACQaq2L96kaLwyHNYr8kHcYaDA==

Received: by recvd-75586bd7d8-d4kqx with SMTP id recvd-75586bd7d8-d4kqx-1-6A37A8A7-6

2026-06-21 09:02:31.046117084 +0000 UTC m=+378627.690296285

Received: from [154.38.165.235] (unknown)

by geopod-ismtpd-25 (SG)

with ESMTP id G8LNT4TtSImDJiJN_Mo1JA

for ;

Sun, 21 Jun 2026 09:02:30.914 +0000 (UTC)

Content-Type: multipart/alternative; boundary="===============7540931904844975849=="

MIME-Version: 1.0

From: Docusend

Subject: You Have a New Secured Document

Date: Sun, 21 Jun 2026 09:02:31 +0000 (UTC)

Message-ID: <178203255046.14396.4451825813358312601@vmi2857862>

X-Mailer: Mailer-4985

X-SG-EID:

=?us-ascii?Q?u001=2Es9z3FKz3theG7asXgt6ElAca8kF7UH1zSPQkdebr12z1S4ULEooo0QM4q?=

=?us-ascii?Q?+52j8OhsDOMjRDtkxywGhq+PSF4dKdsXa=2FUYXIy?=

=?us-ascii?Q?KdF+0Y95d1mrun6=2FOwUEPGooaBBRNeH1n5xiN0O?=

=?us-ascii?Q?X=2FdKvQpQHuWMXon10DFJ5AbTvU4EK+chr0eTd9r?=

=?us-ascii?Q?RezDV6O7xrqPnIf5gIxmpYK7PcUORuSp4AQw7r1?=

=?us-ascii?Q?=2F1XpXZpMbWLgAljo14XEy8=3D?=

To: sales@nk.ca

X-Entity-ID: u001.imBUo2waVNFQ1splhTmG4A==

X-Spam_score: 39.2

X-Spam_score_int: 392

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Shared Document Hello,



Content analysis details: (39.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[154.38.165.235 listed in will-spam-for-food.eu.org]

[154.38.165.235 listed in will-spam-for-food.eu.org]

[154.38.165.235 listed in will-spam-for-food.eu.org]

[154.38.165.235 listed in will-spam-for-food.eu.org]

[154.38.165.235 listed in will-spam-for-food.eu.org]

[154.38.165.235 listed in will-spam-for-food.eu.org]

[154.38.165.235 listed in will-spam-for-food.eu.org]

[154.38.165.235 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.207.117 listed in dnsbl.ahbl.org]

[149.72.207.117 listed in dnsbl.ahbl.org]

[149.72.207.117 listed in dnsbl.ahbl.org]

[149.72.207.117 listed in dnsbl.ahbl.org]

[154.38.165.235 listed in dnsbl.ahbl.org]

[154.38.165.235 listed in dnsbl.ahbl.org]

[154.38.165.235 listed in dnsbl.ahbl.org]

[154.38.165.235 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.207.117 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.207.117 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.207.117 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.207.117 listed in dnsbl.ahbl.org]

1.7 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: u56462072.ct.sendgrid.net]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[149.72.207.117 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[149.72.207.117 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[149.72.207.117 listed in bl.score.senderscore.com]

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} You Have a New Secured Document







Hello,



A shared document has been made available for your review. Please use the secure access button below to open and view the file.







Shared Document for Review



Access the document securely using the link below.

Review Shared Document



Important



For security and confidentiality, please do not share or forward this access link unless authorized.





Thank you,

Docsend



This email was sent to notify you that a document has been shared for review.



© 2026. All rights reserved.

Instagram followers phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 21 Jun 2026 05:30:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbGNB-00000000H63-1PJX

for dave@doctor.nl2k.ab.ca;

Sun, 21 Jun 2026 05:29:57 -0600

Resent-From: The Doctor

Resent-Date: Sun, 21 Jun 2026 05:29:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f200.google.com ([209.85.222.200]:47565)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <3yT43ag0JBXwrflfrfqnfsx3mlrfnq.htrxfqjxsp.hf@maestro.bounces.google.com>)

id 1wb72G-0000000065q-2gU8

for sales@nk.ca;

Sat, 20 Jun 2026 19:31:52 -0600

Received: by mail-qk1-f200.google.com with SMTP id af79cd13be357-915d1d4fc5aso589588685a.3

for ; Sat, 20 Jun 2026 18:30:56 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1782005450; x=1782610250; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=eO3Xe5Ch1grL/sk0AQP0FLJ/o+MA7iAPZeaig3dGN4Q=;

b=ZkqIs9gEb5YC7lK/0ojnxrkQDI0bo8q79sLdswHBJm+vRCmoc50GWM990qS3vjhwIk

th/l1VYLkqfSIthTBqLeQDYVD59yDA1XBbSNfZiwvbXJYCV1gj83+EW+kZUgBz4MMFMN

HlCBuTREcUXH6iOajjzvhu1kvAATR+ufyN/FgaZmP0YYm9lDKLPyNWPWrhoAnVtb6J1e

d1opBgDZf3RSD1+ryK+kzjrI6U8QAnMCLWXr1qcw1DJ+JJk6lJrciar7hJhtgX/WaCjt

vdde1z7dO+hBTr5TnkzGOlqdm+594Nu2dljmR0M9eRV5YpCnurLGGvqQ0mQmyltdehhk

fI/w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782005450; x=1782610250;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=eO3Xe5Ch1grL/sk0AQP0FLJ/o+MA7iAPZeaig3dGN4Q=;

b=rsxYgrq/o5QelaDjm49KM5MLEPrsdiFuVV6UY6MS6zbQAZZqvJo85ai0zoJEc23xBm

HQBcW3CPz+nXKeEJGvJA1IG8V7+sfvcuVKNGboNvw/iSKfVqKUQt/575w4acTEZ6O3Sr

z9GosnSJfxnVJ/HMMy4vM28xdVs1KfA4ubrzwQXsKwMng2mTpH/0hHn5i5aTH3XFbSym

xCROCJdu8wRosP9kBP5GG1BN815NDpcCOyZq4/VL72Sq5FXuTk6L6tn7gLUwq1No2tyO

/3lpNJOup6CbBmIx+BsS4z0e1Aoxg6N2vryewE69WPhFYEsM3G50KRHGn3/7rdNED4dT

WjAw==

X-Gm-Message-State: AOJu0Yz6/bo2m1Fq6WTaXBrjCYqODFbUPMe7Mlwm8sr555EDfC/XQQvV

SosR4eqOJZssOH1s25z7o808/uCaHMz1+42IcCbb4kUNqkpl/SAzbMthqm3iROqLk+bbDPadGpL

krPvURw==

MIME-Version: 1.0

X-Received: by 2002:a05:620a:198b:b0:918:42b4:2c9a with SMTP id

af79cd13be357-920d40386b7mr1345255285a.29.1782005449969; Sat, 20 Jun 2026

18:30:49 -0700 (PDT)

Message-ID:

Date: Sun, 21 Jun 2026 01:30:49 +0000

Subject: daveyadallee, Get More 100,000 Instagram Followers

From: magamaliansyh@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, daveyadallee, Get More 100,000 Instagram Followers Sorry

to interrupt your time. We offer social media services, If you're interested,

please visit our Website. If you're not interested, please skip this step.





Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.200 listed in will-spam-for-food.eu.org]

[209.85.222.200 listed in will-spam-for-food.eu.org]

[209.85.222.200 listed in will-spam-for-food.eu.org]

[209.85.222.200 listed in will-spam-for-food.eu.org]

[209.85.222.200 listed in will-spam-for-food.eu.org]

[209.85.222.200 listed in will-spam-for-food.eu.org]

[209.85.222.200 listed in will-spam-for-food.eu.org]

[209.85.222.200 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.200 listed in dnsbl.ahbl.org]

[209.85.222.200 listed in dnsbl.ahbl.org]

[209.85.222.200 listed in dnsbl.ahbl.org]

[209.85.222.200 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.200 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.200 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[magamaliansyh(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.200 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.200 listed in bl.score.senderscore.com]

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} daveyadallee, Get More 100,000 Instagram Followers



Hi, daveyadallee, Get More 100,000 Instagram Followers

Sorry to interrupt your time.



We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.



We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )



Are you interested in a free trial ?

Special For You Bonus Extra $2 - $5 FREE BALANCE TODAY SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :



[ https://instatool.site/store/free/?daveyadallee ]





Take free trial service today only...!!

10 -101K Instagram Followers



- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest



Thank you,

Regards,



Copyright © 2014 - 2026 instatool.site

Nigerian Compensation spam from Google Gmail Part 2

Posted by Dave Yadallee on
--000000000000012f4e0654b4a67c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation Pr=

ogram

Compensation Award: USD $1,500,000.00

Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77040, USA



Dear Recipient,



We are contacting you as a listed beneficiary in a federally supported

restitution initiative established to compensate victims of financial

fraud. This action follows the prosecution and sentencing of

individuals=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=

=80=94who were

recently convicted of operating fraudulent schemes while posing as

representatives of financial and government institutions.



As part of the outcome, the Midland Financial Recovery Bureau, in

collaboration with U.S. regulatory authorities, has approved a compensation

payment of USD $1,500,000.00 to be issued in your name. Disbursement will

be made through a secure ATM-enabled payment card, and all standard

transaction and delivery costs will be covered by the issuing entity.



To confirm your eligibility and initiate the processing of your payment,

please provide the following information for verification and compliance

review:



Full Legal Name



Residential Mailing Address



Current Occupation



Active Contact Number



Government-Issued Photo Identification (valid)



Please be advised that a nominal Processing and Verification Fee will be

required to complete the official endorsement and release of funds. There

will be no additional fees once this has been fulfilled.



This compensation program is part of a broader effort to assist fraud

victims and reinforce public confidence in financial institutions.



Sincerely,

Mr. Thomas E. Ralston

Director, Compensation Oversight Division

Midland Financial Recovery Bureau



--000000000000012f4e0654b4a67c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv>Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation=

Program
Compensation Award: USD $1,500,000.00
Referenc=

e ID: MF1122-CRX00491
Address: 8600 Westfield Avenue, Suite 210, =

Houston, TX 77040, USA

Dear Recipient,
<=

br>
We are contacting you as a listed beneficiary in a federally =

supported restitution initiative established to compensate victims of finan=

cial fraud. This action follows the prosecution and sentencing of individua=

ls=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=80=94who w=

ere recently convicted of operating fraudulent schemes while posing as repr=

esentatives of financial and government institutions.

<=

div>As part of the outcome, the Midland Financial Recovery Bureau, in colla=

boration with U.S. regulatory authorities, has approved a compensation paym=

ent of USD $1,500,000.00 to be issued in your name. Disbursement will be ma=

de through a secure ATM-enabled payment card, and all standard transaction =

and delivery costs will be covered by the issuing entity.


iv>
To confirm your eligibility and initiate the processing of your pay=

ment, please provide the following information for verification and complia=

nce review:

Full Legal Name


iv>Residential Mailing Address

Current Occupation<=

/div>

Active Contact Number

Gov=

ernment-Issued Photo Identification (valid)

Please=

be advised that a nominal Processing and Verification Fee will be required=

to complete the official endorsement and release of funds. There will be n=

o additional fees once this has been fulfilled.

Th=

is compensation program is part of a broader effort to assist fraud victims=

and reinforce public confidence in financial institutions.

<=

/div>
Sincerely,
Mr. Thomas E. Ralston
Director, Co=

mpensation Oversight Division
Midland Financial Recovery Bureau
div>




--000000000000012f4e0654b4a67c--

Nigerian compensation spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 14:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1xy-00000000OMi-3RWC

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 14:06:58 -0600

Resent-From: The Doctor

Resent-Date: Sat, 20 Jun 2026 14:06:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f67.google.com ([209.85.167.67]:47532)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1ln-00000000Mqq-3dFq

for doctor@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 13:54:33 -0600

Received: by mail-lf1-f67.google.com with SMTP id 2adb3069b0e04-5aa5edf347eso2202818e87.3

for ; Sat, 20 Jun 2026 12:53:37 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781985211; cv=none;

d=google.com; s=arc-20240605;

b=FqFdqQ7naVc89QXMrfy25hrzOg776Sl7/1TJMuylWB72yP1z2b0moeZuLVILvOEfoo

+LElJ+VJcUN1UC4fktJPwTkfUuDt6Yf3W1SW8P0i7mbH9kFrKVu31h5RfYC/eLiXr06i

AO29SW0D5jeo8EoUtWO8rkZefLZtYONSCUDR/N6Ab2i0aihgxwDEr+nlRF3CIHNaywVI

E6+rIEdsaEnNlcm/QNkdfUPQRnDWkDLbH5rq1/xGve6gm+9saEs42H/2kEy0+3HHfBWM

PATipgAKC3WfaFll3wWHK4K/svpnBtwDJQ3MgnJ87sYpkxzwFTF6+kwwugszXGbw5F/a

S/MQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

fh=lLH90XBES8EHzIqFf9luySOCy4F32zJMq6DiT4mnFsY=;

b=WtswqaPUdmL8tOt7L0MCHvj/OLb9rPMLty6ZPh7XizRvF2ZGZ7kO5hGjB7lbUOnDuS

s+5UE+3o6zIzpDQca9tvRlAREoFys6Sc+kWH7RuWnIrp6m7YOiGEyMIQayXr3U2I/WnK

/mIvvhMJIrxg48QQjcfGnIAaVg2ejcXKfKL3evWnNpoVXRkyzuBTEX6zPKhdHaC5bhED

B4U9YOgRM0iB2tXWXwYxLV6eD9ys9kf8dfzUe+stTekjzspYzjIe/weXquxQoxpprTaB

6sTcQVbbm6dHJjzdKM1LnKbU1FPKJrPVDKH4IYZ9VD3TLjSVP3dcK9awkIKOzv5T8QsE

YaZA==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781985211; x=1782590011; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=rCXemlQC4s2xN/0CPlJ7R/UI8lB1KNtsjtm9KIO1Xv9iZcoB0Y2qxlJxQxMcKeEVHP

xzDbgZ5MjS+fEu5D/b5F4JAft109r3RZk3Q70K0EJbzZuFhrbSgY6eMN+p0qIE7Uk5Md

6jeZcWlgUEUFRukdZEv5/gZnd7xo52jOixh/aTyWmcJ/rqBz87l7qw1NH3buWCb+m5rW

JWavy59TmbeHqRGW6A9HBX9Kj/EYALApDWYVWVKTi/o07sDYcJYr1+fMZbPN/imzXNzv

INF9WOK8YDGENshZ8nt1rV432bBybjTJpXbCPCoCQCFBpvF178r8Z3UB+7+E026cy21W

5cTw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781985211; x=1782590011;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=Eequat+TJjahUhxJaHReDUIiBIHlW+Mu9z29245CyufPDhXIJTq7wc3v/p36MS/+lc

Pc/jRGXgJcEljgaiTErYkaXzDKRgzai5OxDwo4v4f+sQ8PBjYFflhkmfI3EDv8sePf0a

eZKh2OvxJOQIFlzN2zfgZnU3YX/cBf9fJgB1aLIGlzpzvl6Gnx+/5kQDsB36X1t4KZfG

tFmJCVY997ppUf3vpqCImajFC9jRLpAFZ5I5egG1ow7LlJSaLHhFcoD4ENlhFmeDN3iv

yBf6K4+4tkkX5YNrepe8gmpMcQWIg2y8HDfIre3TxaGTwWP5A0c2+TKksIrKYBYxfo78

+fxg==

X-Forwarded-Encrypted: i=1; AFNElJ/puNU8uD8Kk4McoPHwOA6VJrS6ME57hfch+Felhywf/DkzlIPrcofWBIO6dTJc6HyKJOKpYvU=@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YyIjuFCR0p/pOpJ1ixwpfGqhzd70WqVVx5g2Dkfv9zRBy+If5fA

LTeicDQRdcOGW3ylZGRVSXSf2TM2Ykv/jH1QTgghxTyzoY6ZxqBRrShe0C2uc0XTp+zpiI2KmII

TpPNjrXHTdYeSTpVNnrmv266rX3j9XYA=

X-Gm-Gg: AfdE7ckHe7//fV08lnn8J2vPf2vOpqfouHq3pRYMS7/Jqc66dALglW/Qg/yxmKPPA+k

ttCg7BmA5lAtCVTB3fadCoUN8xwjsK8FTXcDeNlPCm/JwkAfWX4FuUx9AUAY6oTYsfAavx8HTwH

aOWQU5KwhYAPi4vRSIDH+KWrmrlmhKBN7lFFUM3oVfXk3rIL+GFXmawtrhMSEBSxmj7TZejoD5b

ebbGQD2+FHikamQfBJmuE2OyANWWkN+Gs9NELAWX7D/oxJvRXKVnzdeNq9/fvaQvYaRfgh9ag==

X-Received: by 2002:a2e:a9a5:0:b0:396:9966:50cf with SMTP id

38308e7fff4ca-3998e4092d7mr16710201fa.9.1781984716204; Sat, 20 Jun 2026

12:45:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: citibank.co.usa@gmail.com

From: Michael Corbat

Date: Sat, 20 Jun 2026 12:44:41 -0700

X-Gm-Features: AVVi8Cee6rCzcsUfU88IFtFAIMaK7YU6-UAmDxNctI4bo92nl-eibb70H8m3-qc

Message-ID:

Subject: Compensation Award

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000012f4e0654b4a67c"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 16.4

X-Spam_score_int: 164

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Subject: Midland Financial Recovery Bureau – Victim Compensation

Program Compensation Award: USD $1,500,000.00 Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77 [...]



Content analysis details: (16.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.67 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jeegael37(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[jeegael37(at)gmail.com]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.67 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.67 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Compensation Award